EU Cybersecurity Regulation
The European Union adopts legislation to make the single market work and to protect the people who live in it. This overview explains how EU legislation comes about, who is involved, which types of legal acts exist, and what role standards play. It then lists the EU acts that matter most for cybersecurity.
Contents
Who makes EU law
Three institutions make EU law: the European Commission, the European Parliament, and the Council of the European Union. As a rule, only the Commission can propose new legislation. It submits its proposals to Parliament and the Council, which debate and adopt them. The procedure can involve several readings and, if necessary, a conciliation procedure before the final text is agreed.
Types of legal acts
The EU mainly uses two types of legal acts:
- Regulations apply directly in all Member States and do not need to be transposed into national law. They create uniform rules across borders.
- Directives set goals that all EU countries must achieve but leave the choice of means and methods to national authorities. Member States must transpose them into national law and can take local conditions into account.
Two further types of acts supplement or implement these main acts:
- Delegated acts allow the European Commission to supplement or amend non-essential parts of the main act. The Commission consults expert groups with representatives of all Member States, and the Council and Parliament can scrutinize the act.
- Implementing acts allow the European Commission to ensure that Member States apply the main act in a uniform way. Member States are consulted through the comitology procedure.
Both types make legislation more flexible. They settle technical details or questions of implementation without a new legislative procedure.
Two examples show how this works in practice:
- Delegated act: The delegated act under the Radio Equipment Directive (RED) adds specific cybersecurity requirements for radio equipment. It defines which product categories must meet them without changing the text of the directive itself.
- Delegated and implementing acts: The Cyber Resilience Act (CRA) provides for both. Delegated acts can, for example, update the lists of important and critical products with digital elements. Implementing acts can set uniform conditions for market surveillance across all Member States.
These examples show how EU law can respond to new technology and new security requirements without going through the full legislative procedure each time.
How standards relate to legislation
Standards are technical specifications that set requirements for products, services, or processes. Applying them is usually voluntary unless a law or a contract requires it. Standards document the generally acknowledged state of the art and promote good practice across industry.
For an overview of the standards that matter for cybersecurity, see Standards.
The legislative procedure step by step
The legislative procedure runs through these steps:
- Proposal: The Commission submits a proposal to Parliament and the Council. In specific cases set out in the Treaties, a proposal can also come from a group of Member States, the Court of Justice, the European Central Bank, or the European Investment Bank.
- First reading: Parliament and the Council examine the proposal. If both agree, the act is adopted.
- Second reading: If they do not agree, there is a second reading in which Parliament can approve or reject the Council's position. If there is still no agreement, a conciliation committee is convened.
- Conciliation: The committee tries to reach a compromise. If it agrees on a joint text, a third reading follows.
- Third reading: Parliament and the Council must both approve the joint text. If either does not, the proposal fails.
Key EU acts on cybersecurity
The EU has adopted several acts on cybersecurity and data protection that protect consumers and businesses alike. The most relevant are listed below.
Requirements for operators
These acts require operators of essential and digital services to take strong security measures and manage their risks:
- General Data Protection Regulation (GDPR), Regulation (EU) 2016/679: The core of EU data protection law. It protects the personal data of everyone in the EU, gives individuals more control over their data, and sets strict requirements for companies that process it.
- NIS Directive, Directive (EU) 2016/1148: The first EU directive on the security of network and information systems. It required operators of essential services and digital service providers to take appropriate security measures and report incidents. It was repealed by the NIS2 Directive with effect from October 18, 2024.
- NIS2 Directive, Directive (EU) 2022/2555: Updates and extends the original NIS Directive to address new cybersecurity challenges. It covers more sectors and entities and sets stricter security requirements.
- eIDAS Regulation, Regulation (EU) No 910/2014: Creates a European framework for electronic identification and trust services for electronic transactions in the single market. It ensures that electronic signatures, seals, time stamps, and other trust services are recognized across borders.
Requirements for manufacturers and others placing products on the market
To keep products on the EU market secure, the EU has adopted acts that require manufacturers and other economic operators to address cybersecurity throughout the product lifecycle:
- Cybersecurity Act, Regulation (EU) 2019/881: Establishes a framework for European cybersecurity certification and strengthens the mandate of ENISA, the European Union Agency for Cybersecurity. Its aim is to build trust in the digital single market and raise the level of cybersecurity of ICT products and services.
- Cyber Resilience Act, Regulation (EU) 2024/2847: Sets essential cybersecurity requirements for products with digital elements. Manufacturers must provide security updates and handle vulnerabilities for the support period of their products.
- Radio Equipment Directive, Directive 2014/53/EU, and Delegated Regulation (EU) 2022/30: The directive ensures that radio equipment works safely and without harmful interference. The delegated regulation adds cybersecurity requirements for such equipment.
The EU has also adopted sector-specific acts:
- Machinery Regulation, Regulation (EU) 2023/1230: Sets the safety requirements for machinery, including cybersecurity requirements for machinery used in connected industrial environments.
- Medical Device Regulation, Regulation (EU) 2017/745: Sets safety and performance requirements for medical devices, including cybersecurity requirements for connected devices.
- In Vitro Diagnostic Medical Devices Regulation, Regulation (EU) 2017/746: Sets safety and performance requirements for in vitro diagnostic medical devices, including cybersecurity requirements.
- Marine Equipment Directive (MED), Directive 2014/90/EU: Sets requirements for equipment on board ships. These refer to the Unified Requirements (UR) of the International Association of Classification Societies (IACS), which also define the cyber resilience of onboard systems and equipment.
Together, these acts set uniform rules across the EU and build trust in digital and connected products and services.
Support with implementation
Cybersecurity requirements are growing in many industries, driven by EU acts such as the Cyber Resilience Act, the Radio Equipment Directive, and the Machinery Regulation. For manufacturers, technical safeguards alone are no longer enough. Processes, evidence, and responsibilities also need to be reviewed and adjusted.
Secuvise helps companies understand these acts and put them into practice. We identify what your company needs to do, set priorities, and support the implementation, from the first analysis to day-to-day operations.
If you need to build European cybersecurity requirements into your product development and organization, we can support you with technical, regulatory, and methodological expertise.